Types for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

Exploit for File Descriptor Leak in Linuxfoundation Runc

PoC of CVE-2024-21626 Read my full article for detailed explan...

Insecure Variable Substitution in Vela

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

CVE-2024-24562

vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit 68dfa6614 which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While ...

CVE-2024-24562 Security headers not set in vantage6-UI

vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit 68dfa6614 which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While ...

CVE-2024-24562

CVE-2024-24562 affects vantage6-UI (the interface for the vantage6 server). The vulnerability is due to security headers not being set in affected versions. A fix has been committed (68dfa6614) and is expected in future releases; upgrade to a new release when available. If upgrading is not possib...

CVE-2024-24562 Security headers not set in vantage6-UI

vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit 68dfa6614 which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While ...

CVE-2024-24562 Security headers not set in vantage6-UI

vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit 68dfa6614 which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While ...

PT-2024-20453 · Docker +2 · Docker +2

Name of the Vulnerable Software and Affected Versions: vantage6-UI affected versions not specified Description: The issue is related to the absence of certain security headers in the vantage6-UI, which is the official user interface for the vantage6 server. This problem has been addressed in a...

org.apache.pulsar:pulsar-docker-image (>=2.6.0, <=2.7.5), org.apache.pulsar:pulsar-server-distribution (>=2.6.0, <=2.10.5) potentially affected by CVE-2022-34321 via org.apache.pulsar:pulsar-proxy (>=2.6.0, <=2.10.5)

org.apache.pulsar:pulsar-proxy MAVEN version =2.6.0, =2.6.0, =2.6.0, =2.10.5 Source cves: CVE-2022-34321 Source advisory: GHSA-C35H-W8HJ-MM55...

org.apache.pulsar:pulsar-docker-image (>=2.6.0, <=2.7.5), org.apache.pulsar:pulsar-server-distribution (>=2.6.0, <=2.10.5) potentially affected by CVE-2022-34321 via org.apache.pulsar:pulsar-proxy (>=2.6.0, <=2.10.5)

org.apache.pulsar:pulsar-proxy MAVEN version =2.6.0, =2.6.0, =2.6.0, =2.10.5 Source cves: CVE-2022-34321 Source advisory: OSV:GHSA-C35H-W8HJ-MM55...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), com.clever-cloud:biscuit-pulsar (>=2.2.2, <=3.2.1) +11 more potentially affected by CVE-2024-27135 via org.apache.pulsar:pulsar-functions-worker (>=2.4.0, <=2.10.5)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.4.0, =2.7.1.5, =2.2.2, =3.1.7, =3.6, =3.6, =0.0.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.0.0, =1.1.0 Source cves: CVE-2024-27135 Source advisory: GHSA-XP2R-G8QQ-44HH...

CVE-2024-28236

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

CVE-2024-28236 Insecure Variable Substitution in Vela

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

CVE-2024-28236 Insecure Variable Substitution in Vela

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

CVE-2024-28236 Insecure Variable Substitution in Vela

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

org.apache.pulsar:pulsar-docker-image (>=2.6.0, <=2.7.5), org.apache.pulsar:pulsar-server-distribution (>=2.6.0, <=2.10.5) potentially affected by CVE-2022-34321 via org.apache.pulsar:pulsar-proxy (>=2.6.0, <=2.10.5)

org.apache.pulsar:pulsar-proxy MAVEN version =2.6.0, =2.6.0, =2.6.0, =2.10.5 Source cves: CVE-2022-34321 Source advisory: MEND:CVE-2022-34321...

Important: Red Hat Security Advisory: docker security update

An update for docker is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Improper Authorization

org.jenkins-ci.plugins:docker-build-step is vulnerable to Improper Authorization. The vulnerability is due to inadequate permission validation, allowing attackers with Overall/Read permission to connect to attacker-specified TCP or Unix socket URLs and reconfigure the plugin using provided...

Cross Site Request Forgery (CSRF)

org.jenkins-ci.plugins: docker-build-step is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to inadequate validation of user inputs, allowing attackers to connect to an attacker-specified TCP or Unix socket URL and reconfigure the plugin using provided connection test...